[PATCH] tools/virtiofsd: Add rseq syscall to the seccomp allowlist

[PATCH] tools/virtiofsd: Add rseq syscall to the seccomp allowlist

[christian.ehrhardt]

From: Christian Ehrhardt <christian.ehrhardt@canonical.com>

The virtiofsd currently crashes when used with glibc 2.35.
That is due to the rseq system call being added to every thread
creation [1][2].

[1]: https://www.efficios.com/blog/2019/02/08/linux-restartable-sequences/
[2]: https://sourceware.org/pipermail/libc-alpha/2022-February/136040.html

This happens not at daemon start, but when a guest connects

    /usr/lib/qemu/virtiofsd -f --socket-path=/tmp/testvfsd -o sandbox=chroot \
        -o source=/var/guests/j-virtiofs --socket-group=kvm
    virtio_session_mount: Waiting for vhost-user socket connection...
    # start ok, now guest will connect
    virtio_session_mount: Received vhost-user socket connection
    virtio_loop: Entry
    fv_queue_set_started: qidx=0 started=1
    fv_queue_set_started: qidx=1 started=1
    Bad system call (core dumped)

We have to put rseq on the seccomp allowlist to avoid that the daemon
is crashing in this case.

Reported-by: Michael Hudson-Doyle <michael.hudson@canonical.com>
Signed-off-by: Christian Ehrhardt <christian.ehrhardt@canonical.com>
---
 tools/virtiofsd/passthrough_seccomp.c | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/tools/virtiofsd/passthrough_seccomp.c b/tools/virtiofsd/passthrough_seccomp.c
index a3ce9f898d..21b8f53bd9 100644
--- a/tools/virtiofsd/passthrough_seccomp.c
+++ b/tools/virtiofsd/passthrough_seccomp.c
@@ -116,6 +116,9 @@ static const int syscall_allowlist[] = {
     SCMP_SYS(write),
     SCMP_SYS(writev),
     SCMP_SYS(umask),
+#ifdef __NR_rseq
+    SCMP_SYS(rseq), /* required since glibc 2.35 */
+#endif
 };
 
 /* Syscalls used when --syslog is enabled */
-- 
2.35.0

Re: [PATCH] tools/virtiofsd: Add rseq syscall to the seccomp allowlist

[Dr. David Alan Gilbert]

* christian.ehrhardt@canonical.com (christian.ehrhardt@canonical.com) wrote:
> From: Christian Ehrhardt <christian.ehrhardt@canonical.com>
> 
> The virtiofsd currently crashes when used with glibc 2.35.
> That is due to the rseq system call being added to every thread
> creation [1][2].
> 
> [1]: https://www.efficios.com/blog/2019/02/08/linux-restartable-sequences/
> [2]: https://sourceware.org/pipermail/libc-alpha/2022-February/136040.html
> 
> This happens not at daemon start, but when a guest connects
> 
>     /usr/lib/qemu/virtiofsd -f --socket-path=/tmp/testvfsd -o sandbox=chroot \
>         -o source=/var/guests/j-virtiofs --socket-group=kvm
>     virtio_session_mount: Waiting for vhost-user socket connection...
>     # start ok, now guest will connect
>     virtio_session_mount: Received vhost-user socket connection
>     virtio_loop: Entry
>     fv_queue_set_started: qidx=0 started=1
>     fv_queue_set_started: qidx=1 started=1
>     Bad system call (core dumped)
> 
> We have to put rseq on the seccomp allowlist to avoid that the daemon
> is crashing in this case.
> 
> Reported-by: Michael Hudson-Doyle <michael.hudson@canonical.com>
> Signed-off-by: Christian Ehrhardt <christian.ehrhardt@canonical.com>

Thanks! I bet this is going to pop up in zillions of programs.

Reviewed-by: Dr. David Alan Gilbert <dgilbert@redhat.com>

> ---
>  tools/virtiofsd/passthrough_seccomp.c | 3 +++
>  1 file changed, 3 insertions(+)
> 
> diff --git a/tools/virtiofsd/passthrough_seccomp.c b/tools/virtiofsd/passthrough_seccomp.c
> index a3ce9f898d..21b8f53bd9 100644
> --- a/tools/virtiofsd/passthrough_seccomp.c
> +++ b/tools/virtiofsd/passthrough_seccomp.c
> @@ -116,6 +116,9 @@ static const int syscall_allowlist[] = {
>      SCMP_SYS(write),
>      SCMP_SYS(writev),
>      SCMP_SYS(umask),
> +#ifdef __NR_rseq
> +    SCMP_SYS(rseq), /* required since glibc 2.35 */
> +#endif
>  };
>  
>  /* Syscalls used when --syslog is enabled */
> -- 
> 2.35.0
> 
> 
-- 
Dr. David Alan Gilbert / dgilbert@redhat.com / Manchester, UK

Re: [PATCH] tools/virtiofsd: Add rseq syscall to the seccomp allowlist

[Stefan Hajnoczi]

[-- Attachment #1: Type: text/plain, Size: 1450 bytes --]

On Wed, Feb 09, 2022 at 12:14:56PM +0100, christian.ehrhardt@canonical.com wrote:
> From: Christian Ehrhardt <christian.ehrhardt@canonical.com>
> 
> The virtiofsd currently crashes when used with glibc 2.35.
> That is due to the rseq system call being added to every thread
> creation [1][2].
> 
> [1]: https://www.efficios.com/blog/2019/02/08/linux-restartable-sequences/
> [2]: https://sourceware.org/pipermail/libc-alpha/2022-February/136040.html
> 
> This happens not at daemon start, but when a guest connects
> 
>     /usr/lib/qemu/virtiofsd -f --socket-path=/tmp/testvfsd -o sandbox=chroot \
>         -o source=/var/guests/j-virtiofs --socket-group=kvm
>     virtio_session_mount: Waiting for vhost-user socket connection...
>     # start ok, now guest will connect
>     virtio_session_mount: Received vhost-user socket connection
>     virtio_loop: Entry
>     fv_queue_set_started: qidx=0 started=1
>     fv_queue_set_started: qidx=1 started=1
>     Bad system call (core dumped)
> 
> We have to put rseq on the seccomp allowlist to avoid that the daemon
> is crashing in this case.
> 
> Reported-by: Michael Hudson-Doyle <michael.hudson@canonical.com>
> Signed-off-by: Christian Ehrhardt <christian.ehrhardt@canonical.com>
> ---
>  tools/virtiofsd/passthrough_seccomp.c | 3 +++
>  1 file changed, 3 insertions(+)

Thanks, applied to my block tree:
https://gitlab.com/stefanha/qemu/commits/block

Stefan

[-- Attachment #2: signature.asc --]
[-- Type: application/pgp-signature, Size: 488 bytes --]